DEV Community

Cover image for Safari Surgery, Agent Attacks, and CI Seatbelts
Adam
Adam

Posted on

Safari Surgery, Agent Attacks, and CI Seatbelts

Browser and build plumbing got the kind of attention that usually only arrives after something catches fire. WebKit finally rebuilt Safari's module loader to fix top-level await properly, Zod 4.6 brings a much faster validate(), and GitHub shared the very real edge cases behind porting Copilot's runtime from Node to Rust without stopping the train. On the database side, Postgres 19 plan advice looks like a new lever for taming stubborn query plans, while WalShadow streams physical WAL into ClickHouse with near-real-time latency.

Meanwhile, the agents continued to stress-test civilization. rubyhack.ai reports an agent-driven RubyGems supply-chain attack, F5 Labs documents mass scanning of exposed Vite dev servers for .env loot, and Anthropic explains how agentic coding caused a 25x CI-job spike that forced a rethink of test impact analysis. If the mood here is "please add guardrails before the demo," that is because the week earned it.

Tooling, thankfully, stayed constructive. @shadcn/lint targets the exact Tailwind and design-system messes agents love to generate, modern-web-types ships browser-early DOM typings before lib.dom catches up, and fallow promises dead-code and complexity detection with zero config. Altogether: better runtimes, sharper database knobs, and a growing pile of evidence that the real AI platform work happens in the infrastructure around the model.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 11 highlighted links of weeklyfoo #155:


Fixing top-level await in Safari

by WebKit Blog

WebKit rewrote Safari's module loader in native C++ after the old one relied on the abandoned 2016 WHATWG Loader proposal, fixing top-level await and an import-order bug

📰 Good to know, javascript,safari,webkit


OpenAI agents carried out an undisclosed cyberattack on RubyGems

by rubyhack.ai

Researchers attribute a May campaign of 2000+ malicious packages to an agent swarm that abused RubyDoc.info builds for remote execution

📰 Good to know, security,supply-chain,ai


Agentic coding is straining CI, here's how Anthropic scaled test impact analysis

by Anthropic

A 25x jump in CI jobs in six months broke a singleton test selection service, replaced by stateless listener workers, an in-memory journal and a separate rollup consumer

📰 Good to know, ci,testing,ai


Mass scanning for exposed Vite dev servers

by F5 Labs

Attackers exploit a server.fs.deny bypass to pull credentials from .env files, patched in Vite 7.3.2 and 8.0.5

📰 Good to know, security,vite


Zod 4.6

by Zod

Adds validate(), a boolean check up to 35x faster than safeParse().success on invalid input with compiled schemas

📰 Good to know, typescript,validation


Plan advice in Postgres 19

by Dimitri Fontaine

pg_plan_advice and pg_stash_advice capture planner advice, enforce it selectively and apply it automatically by query id

📰 Good to know, postgres,database


Why GitHub ported Copilot's runtime from Node to Rust

by GitHub Blog

Ported piece by piece behind napi-rs shims while shipping daily, with the real lessons hiding in number types, logical-or semantics and a blocked event loop

📰 Good to know, rust,nodejs,performance


@shadcn/lint

by shadcn

Agent-first linter for Tailwind design systems that works with existing systems without a rewrite

🧰 Tools, tailwind,lint,ai


modern-web-types

by Philip Walton

Drop-in lib.dom replacement adding TypeScript types for APIs shipped in only one browser engine, like element-scoped startViewTransition

🧰 Tools, typescript,web,types


fallow

by Bart Waardenburg

Zero-config Rust binary that finds dead code, duplication, circular dependencies and complexity hotspots in JS and TS projects

🧰 Tools, typescript,lint,tooling


WalShadow

by ClickHouse

Replicates Postgres into ClickHouse from the physical WAL instead of logical decoding, at roughly 200ms commit-to-visible latency

🧰 Tools, postgres,clickhouse,opensource


Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Top comments (0)